gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
BugLink: https://bugs.launchpad.net/bugs/2109640 commit 7c9d9223802fbed4dee1ae301661bf346964c9d2 upstream. Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space will either use buffer heads or iomap_folio_state structs, and we cannot mix the two. Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CVE-2025-21699 Signed-off-by: Manuel Diewald <manuel.diewald@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
This commit is contained in:
committed by
Stefan Bader
parent
a84f266655
commit
87d49ed5ba
@@ -251,6 +251,7 @@ static int do_gfs2_set_flags(struct inode *inode, u32 reqflags, u32 mask)
|
||||
error = filemap_fdatawait(inode->i_mapping);
|
||||
if (error)
|
||||
goto out;
|
||||
truncate_inode_pages(inode->i_mapping, 0);
|
||||
if (new_flags & GFS2_DIF_JDATA)
|
||||
gfs2_ordered_del_inode(ip);
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user